# CVE-2026-112780: Grav allowlist bypass in Flex form field renaming

Source: https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112780 · Severity: high · CVSS 8.8 · Published 2026-10-19

Grav is a file-based content management system. A vulnerability allows users with page editing permissions to bypass security checks and call arbitrary server-side methods, potentially leading to deletion of directories, modification of files, or unauthorized file access outside the intended content areas.

Technologies: [Getgrav Grav](https://junglewise.ai/threats/technologies/getgrav-grav-1). Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav).

## Quick answers

**Is CVE-2026-112780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112780 being exploited in the wild.

**How severe is CVE-2026-112780?** High severity, with a CVSS score of 8.8, published 19 October 2026.

**Which products and versions are affected?** Getgrav Grav 2.0.15 to 2.2.1.

**Is there a fix for CVE-2026-112780?** Yes: fixed in 2.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112780 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-112780?** Check whether you run Getgrav Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.2.2

## Technical details

The vulnerability is an allowlist bypass in Grav's Flex form handling via the replace-name@ directive. When a page editor renames a Flex form field using replace-name@, the field and its directive are moved to a new key that is incorrectly marked as trusted, bypassing the allowed-callable check. This allows invocation of arbitrary public static methods like Folder::delete, Folder::move, or Utils::download with page-edit permissions.

## Affected products

- getgrav Grav 2.0.15 to 2.2.1

## Timeline

- 2026-10-05: disclosed
- 2026-10-19: advisory

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-9rq7-4cch-f22j](https://github.com/getgrav/grav/security/advisories/GHSA-9rq7-4cch-f22j)
- [https://www.vulncheck.com/advisories/grav-2.0.15-before-2.2.2-arbitrary-static-method-call-via-flex-form-replace-name](https://www.vulncheck.com/advisories/grav-2.0.15-before-2.2.2-arbitrary-static-method-call-via-flex-form-replace-name)

## Related threats

- [Grav authorization bypass in Clockwork profiler debugger](https://junglewise.ai/threats/cve-2026-117604-grav-from-1-7-53-3-before-1-7-53-6-contains-an-authorization)
- [Grav information disclosure via form config directives](https://junglewise.ai/threats/cve-2026-112781-grav-from-2-0-0-before-2-2-2-contains-an-information-disclosure)
- [Grav session cookie theft via Twig sandbox](https://junglewise.ai/threats/cve-2026-100671-grav-is-a-flat-file-cms-in-versions-2-0-19-through-2-0-24-and-in)
- [Grav sandbox escape via array filter](https://junglewise.ai/threats/cve-2026-100668-grav-2-0-0-through-2-0-24-contain-a-twig-content-sandbox-escape)
- [Grav may be vulnerable to SSRF attack via Twig Templates](https://junglewise.ai/threats/cve-2025-66844-grav-may-be-vulnerable-to-ssrf-attack-via-twig-templates)